Vulnerability · Published Aug 2, 2026 · Assigned by WPScan
CVE-2026-16261Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
High 7.5
In plain English
A high-severity improper authentication in login-social from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | login-social | 0 – through 1.0.4 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://wpscan.com/vulnerability/533f9347-e7cd-4a86-8cb5-f6d4aaaf4dd1/ exploit, vdb-entry, technical-description